Alerting

How to set alert to know any alert Script is ran/not for the scheduled alert

phanichintha
Path Finder

Hello!

Can anyone please help how to know if we ran an alert/not for a scheduled alert? 
We set the below alert for every Monday 6:00 am.

Alert Example:

| makeresults
| eval ip_ports = "10.120.121.100:9443"
| eval ip_ports = split(ip_ports,",")
| mvexpand ip_ports
| rex field=ip_ports "(?<dest>[^:]+):(?<dest_port>\d+)"
| table dest dest_port
| lookup sslcert_lookup dest dest_port
| eval days_left = round(ssl_validity_window/86400)
| eval ssl_end_time=strftime(ssl_end_time,"%Y-%m-%d")
| eval ssl_start_time=strftime(ssl_start_time,"%Y-%m-%d")
| where days_left < 60

 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Splunk logs that for you.  Search the logs with a query like this:

index=_internal source=*scheduler.log search_type=scheduled savedsearch_name="<alert name>"

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

phanichintha
Path Finder

@richgalloway Hello, thanks for the query i got great results, so some more need to do based on the below query, I need an alert for if any of the searches are not run I need the alert to mail.

index=_internal source=*scheduler.log search_type=scheduled savedsearch_name="Expiry of SSL Certificates for UI Instances" OR savedsearch_name="Expiry of SSL Certificates for FR Instances" OR savedsearch_name="Expiry of SSL Certificates for Mulesoft Instances" OR savedsearch_name="Expiry of DNS SSL Certificates"
| stats count by savedsearch_name

phanichintha_0-1626786110610.png

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Search for status != success

---
If this reply helps you, Karma would be appreciated.
0 Karma

phanichintha
Path Finder

@richgalloway I didn`t get any results other than success. I need other than success saved alerts out of 4.

phanichintha_0-1626789705518.png

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Congratulations!  None of your alerts failed to run.  Save that search as an alert and have it trigger when the number of results is not zero.  That will happen when status!=success some time in the future.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...